Systems Administrator - Active Directory & Entra ID

We’re hiring a Systems Administrator to support our hybrid identity environment across on-premises Active Directory and Microsoft Entra ID. The role requires the ability to produce the identity and access evidence that supports our FISMA compliance and NIST SP 800-53 control assessments.

This role reports to the ICAM Team Lead and works closely with the service desk, the Information System Security Officer (ISSO), Active Directory

• Administer users, groups, computers, and OUs across one or more AD domains.
• Manage Group Policy, DNS, and DHCP, and keep domain controllers healthy, patched, and replicating.
• Delegate permissions using least privilege and review AD ACLs and privileged group membership.
• Plan and perform AD backups, recovery testing, and domain controller upgrades.

Microsoft Entra ID

• Manage cloud users, groups, licensing, and administrative units in Entra ID.
• Configure and maintain Conditional Access, MFA, self-service password reset, and authentication methods.
• Administer directory roles and Privileged Identity Management (PIM), including access reviews.
• Register and govern enterprise applications, SSO (SAML/OIDC), and API permission consents.

FISMA and NIST SP 800-53 compliance

• Implement and maintain identity controls mapped to NIST SP 800-53, especially the Access Control (AC), Identification and Authentication (IA), and Audit and Accountability (AU) families.
• Produce recurring compliance reports, such as privileged account inventories, inactive account reviews, MFA coverage, and role assignment exports.
• Gather and organize evidence for annual FISMA assessments, Authority to Operate (ATO) packages, and continuous monitoring.
• Contribute identity sections to the System Security Plan (SSP) and keep control implementation statements current.
• Track identity-related findings in Plans of Action and Milestones (POA&Ms) and drive them to closure.
• Support auditors and assessors with walkthroughs, screenshots, and log evidence.

Hybrid identity and security operations

• Operate and troubleshoot Entra Connect (or Cloud Sync) for directory synchronization.
• Monitor sign-in and audit logs, respond to identity-related alerts, and support incident investigations.
• Maintain identity documentation, runbooks, and onboarding/offboarding procedures.

Support and collaboration

• Serve as escalation point for account, access, and authentication issues from the service desk.
• Partner with security and application teams on new projects, migrations, and access designs.
• Participate in a shared on-call rotation for critical identity services.

• 4+ years of systems administration experience in a Windows enterprise environment.
• Strong hands-on experience administering Active Directory, including Group Policy, DNS, and delegation.
• 2+ years administering Microsoft Entra ID (formerly Azure AD), including Conditional Access and MFA.
• Experience supporting a hybrid identity setup with Entra Connect or Cloud Sync.
• Working knowledge of FISMA requirements and NIST SP 800-53 controls, with experience producing compliance reports or audit evidence.
• Working knowledge of Microsoft 365 administration and licensing.
• Solid understanding of authentication protocols such as Kerberos, NTLM, SAML, and OAuth/OIDC.
• Clear written communication for documentation, control statements, and working with non-technical staff.
• Bachelor’s degree in IT or a related field, or equivalent work experience.
• Ability to obtain and maintain [Public Trust / Secret] clearance, if required.

Preferred qualifications

• PowerShell scripting to automate AD and Entra ID tasks and compliance reports, including the Active Directory module and Microsoft Graph PowerShell SDK.

• Experience with the NIST Risk Management Framework (RMF), SSPs, POA&Ms, and ATO processes.

• Familiarity with FedRAMP, Microsoft GCC/GCC High, or other government cloud environments.

• Experience applying DISA STIGs or CIS Benchmarks to Windows servers and domain controllers.

• Experience with Privileged Identity Management, access reviews, and identity governance.

• Exposure to Azure RBAC, Microsoft Intune, Microsoft Defender for Identity, or Entra ID Protection.

• Certifications such as Microsoft SC-300 (Identity and Access Administrator), Security+, or CAP/CGRC.